> Do they randomize them? or just count in odd fashion?
> I don't actually know the tests that nmap is doing, but 'count XOR 0xaaaa'
> would (probably) show up as random.
see nmap osscan.cc:ipid_sequence.
itojun